Policy Configuration
Policies are the heart of CtrlOne - a named set of restrictions that devices enforce. This guide explains how policies are applied, how enforcement actually works, and how to change them safely.
The policy-only model
CtrlOne enforces every restriction through Windows Group Policy and registry policy, backed by service control where relevant. It does not rename executables, delete app files, change install paths, or patch binaries. That keeps enforcement clean and reversible: remove the policy and the underlying Windows setting returns to normal.
Applying and reassigning
Create a policy in the console, choose its restrictions, and assign it to devices or groups. Changes propagate to devices as they check in. You can reassign devices to a different policy at any time, individually or in bulk.
Versioning and rollback
Every change to a policy is snapshotted, so you have a history of prior states. If a change causes problems you can roll back to an earlier version - and because rolling back snapshots the current state first, the rollback itself is undoable.
Templates and scheduling
Start from a curated template - kiosk lockdown, office baseline, or lab/classroom - instead of a blank policy. For time-based control, the auto-scheduler can apply and remove restrictions on a daily window, so, for example, cameras and internet can be blocked during class hours and restored afterward with no manual touch.
Frequently asked questions
What happens to restrictions if I delete a policy?
Because enforcement is policy-based, removing the policy lifts the restrictions and the affected Windows settings return to their prior state.
Can I undo a bad policy change?
Yes. Policies are versioned; roll back to a previous snapshot. The rollback records the current state first, so it can be reversed too.
Do policy changes apply instantly?
Changes flow to devices as they check in with the console. A device that is offline picks up the change when it reconnects.
Explore the restriction surfaces
See the device control overview for how USB, application, and browser restrictions fit together.